A court e-discovery ML pipeline has no quarantine path when malware scanners flag uploaded evidence PDFs. What ingestion control is missing?
Select an answer to reveal the explanation.
Short Explanation
Flagged evidence PDFs need a holding cell, not a free pass into the ML kitchen. Quarantine before features or training. Instant deletes, skipped scans, and direct vector indexing of bad files are unsafe.
Full Explanation
A court e-discovery ML pipeline with no quarantine path when malware scanners flag uploaded evidence PDFs is missing quarantining of suspicious uploads before they enter feature or training paths. Flagged evidence must be held in an isolated area so malware does not execute on OCR/feature workers and so poisoned content does not enter indexes used for discovery ML. Quarantine preserves the ability to investigate while stopping automatic advancement into trusted processing stages—critical when handling court evidence under chain-of-custody expectations.
Auto-deleting all evidence after thirty seconds of OCR fails because it destroys potentially required legal records and is not a malware response. Skipping malware scans to meet discovery deadlines fails because speed without scanning invites worker compromise. Forwarding flagged PDFs straight into the production vector index fails because it treats a positive detection as a green light for indexing.
Exam caveat: quarantine is the holding control between detection and disposition; deletion without process and “index anyway” are both wrong for court pipelines.
Operational check: implement a quarantine store with no execute rights for worker roles; block feature extraction and vector indexing until a disposition decision; test with a known-bad PDF in a lab lane; document who may release or destroy quarantined evidence under court policy.